🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5078d5aa13b0716014bc8c705e0c461251154e2ec4da60b57e369ed1fca2f29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ladvix


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5078d5aa13b0716014bc8c705e0c461251154e2ec4da60b57e369ed1fca2f29
SHA3-384 hash: 9844eb957f02059a4a6b67013cc2626e34aa56c58e17c112609c5ad74134d2b0863da3126162ef507150ac2633835596
SHA1 hash: 931f4424e52fcd4d9c39b836955e1fa1762a5f9a
MD5 hash: 7078addb3b8a77e125fc2309d415cef4
humanhash: north-angel-missouri-twenty
File name:check.sh
Download: download sample
Signature Ladvix
Create hunting rule
File size:146 bytes
First seen:2026-08-11 11:56:36 UTC
Last seen:2026-08-12 09:25:41 UTC
File type: sh
MIME type:text/plain
ssdeep 3:QFKIaM3BFDz5TLTeUWcjYqL0zTLTeUWcjYqLROOdoJFTG0sF/XK4vn:QOSB15fW8Yy0fW8YyR8LTAFd
TLSH T1E6C08CB528628C0AA4C48408326A851140803C43119E3FDDF888A5800F8A88AB145B20
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.211/boss681817158553beede00a5fd1225912d3e0740c6337853a62f65927e8f0f12010 Ladvixcensys elf ladvix ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
46
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
URLhaus.3902005.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a7b0e364d0e928aec88e3de/reports/caee046c-219a-47d9-b1b3-a1f762e9e378/overview
Verdict:
Unknown
File Type:
text
Link:
https://opentip.kaspersky.com/c5078d5aa13b0716014bc8c705e0c461251154e2ec4da60b57e369ed1fca2f29/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ceb27289-0de8-48fb-9294-548c6aa9ad81
Behavior Graph:
Download SVG
%3 guuid=788c9104-1a00-0000-085c-4738040b0000 pid=2820 /usr/bin/sudo guuid=938bf006-1a00-0000-085c-4738060b0000 pid=2822 /tmp/sample.bin guuid=788c9104-1a00-0000-085c-4738040b0000 pid=2820->guuid=938bf006-1a00-0000-085c-4738060b0000 pid=2822 execve guuid=72e05907-1a00-0000-085c-4738070b0000 pid=2823 /usr/bin/curl net send-data write-file guuid=938bf006-1a00-0000-085c-4738060b0000 pid=2822->guuid=72e05907-1a00-0000-085c-4738070b0000 pid=2823 execve guuid=748df429-1b00-0000-085c-4738900c0000 pid=3216 /usr/bin/wget net send-data write-file guuid=938bf006-1a00-0000-085c-4738060b0000 pid=2822->guuid=748df429-1b00-0000-085c-4738900c0000 pid=3216 execve guuid=b7ad36d1-1b00-0000-085c-4738510d0000 pid=3409 /usr/bin/chmod guuid=938bf006-1a00-0000-085c-4738060b0000 pid=2822->guuid=b7ad36d1-1b00-0000-085c-4738510d0000 pid=3409 execve guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411 /var/tmp/boss write-config zombie guuid=938bf006-1a00-0000-085c-4738060b0000 pid=2822->guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411 execve 0eae001c-4ad4-599c-ab6a-77d3fac12203 176.65.139.211:80 guuid=72e05907-1a00-0000-085c-4738070b0000 pid=2823->0eae001c-4ad4-599c-ab6a-77d3fac12203 send: 82B guuid=748df429-1b00-0000-085c-4738900c0000 pid=3216->0eae001c-4ad4-599c-ab6a-77d3fac12203 send: 133B guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3418 /var/tmp/boss zombie guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3418 clone guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3419 /var/tmp/boss guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3419 clone guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3420 /var/tmp/boss guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3420 clone guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3421 /var/tmp/boss guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3421 clone guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3422 /var/tmp/boss zombie guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3422 clone guuid=6663c0d8-1b00-0000-085c-47385f0d0000 pid=3423 /var/tmp/boss guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=6663c0d8-1b00-0000-085c-47385f0d0000 pid=3423 clone guuid=22350fd9-1b00-0000-085c-4738610d0000 pid=3425 /usr/bin/uname guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=22350fd9-1b00-0000-085c-4738610d0000 pid=3425 execve guuid=5def4eda-1b00-0000-085c-4738650d0000 pid=3429 /usr/bin/chmod guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=5def4eda-1b00-0000-085c-4738650d0000 pid=3429 execve guuid=57dd8c03-1c00-0000-085c-4738d20d0000 pid=3538 /usr/bin/systemctl guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=57dd8c03-1c00-0000-085c-4738d20d0000 pid=3538 execve guuid=a9b0cf46-1c00-0000-085c-4738810e0000 pid=3713 /usr/bin/systemctl guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=a9b0cf46-1c00-0000-085c-4738810e0000 pid=3713 execve guuid=577f4f7f-1c00-0000-085c-47380c0f0000 pid=3852 /usr/bin/systemctl guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=577f4f7f-1c00-0000-085c-47380c0f0000 pid=3852 execve guuid=ed0a5984-1c00-0000-085c-47381f0f0000 pid=3871 /usr/bin/pgrep guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=ed0a5984-1c00-0000-085c-47381f0f0000 pid=3871 execve guuid=ef5f2888-1c00-0000-085c-4738340f0000 pid=3892 /usr/bin/bash guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3411->guuid=ef5f2888-1c00-0000-085c-4738340f0000 pid=3892 execve guuid=2a66b889-1c00-0000-085c-47383b0f0000 pid=3899 /usr/bin/bash guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3422->guuid=2a66b889-1c00-0000-085c-47383b0f0000 pid=3899 execve guuid=d8a29a8b-1c00-0000-085c-47383f0f0000 pid=3903 /usr/bin/rm delete-file guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3422->guuid=d8a29a8b-1c00-0000-085c-47383f0f0000 pid=3903 execve guuid=a31ca793-1c00-0000-085c-47384b0f0000 pid=3915 /usr/bin/bash zombie guuid=1139e8d1-1b00-0000-085c-4738530d0000 pid=3422->guuid=a31ca793-1c00-0000-085c-47384b0f0000 pid=3915 execve guuid=ca75f4db-1b00-0000-085c-47386b0d0000 pid=3435 /usr/bin/curl net send-data write-file guuid=5def4eda-1b00-0000-085c-4738650d0000 pid=3429->guuid=ca75f4db-1b00-0000-085c-47386b0d0000 pid=3435 execve a633da7e-6415-55fb-93ef-5ee209767fd5 2.57.241.243:80 guuid=ca75f4db-1b00-0000-085c-47386b0d0000 pid=3435->a633da7e-6415-55fb-93ef-5ee209767fd5 send: 82B guuid=b85e7a88-1c00-0000-085c-4738350f0000 pid=3893 /usr/bin/rm delete-file guuid=ef5f2888-1c00-0000-085c-4738340f0000 pid=3892->guuid=b85e7a88-1c00-0000-085c-4738350f0000 pid=3893 execve guuid=7d8af088-1c00-0000-085c-4738390f0000 pid=3897 /usr/bin/rm delete-file guuid=ef5f2888-1c00-0000-085c-4738340f0000 pid=3892->guuid=7d8af088-1c00-0000-085c-4738390f0000 pid=3897 execve guuid=a0013a89-1c00-0000-085c-47383a0f0000 pid=3898 /usr/bin/rm guuid=ef5f2888-1c00-0000-085c-4738340f0000 pid=3892->guuid=a0013a89-1c00-0000-085c-47383a0f0000 pid=3898 execve guuid=e80d3294-1c00-0000-085c-47384d0f0000 pid=3917 /usr/bin/wget net send-data write-file guuid=a31ca793-1c00-0000-085c-47384b0f0000 pid=3915->guuid=e80d3294-1c00-0000-085c-47384d0f0000 pid=3917 execve guuid=a54593e7-1d00-0000-085c-4738a3100000 pid=4259 /usr/bin/chmod guuid=a31ca793-1c00-0000-085c-47384b0f0000 pid=3915->guuid=a54593e7-1d00-0000-085c-4738a3100000 pid=4259 execve guuid=548cdae7-1d00-0000-085c-4738a4100000 pid=4260 /usr/bin/bash zombie guuid=a31ca793-1c00-0000-085c-47384b0f0000 pid=3915->guuid=548cdae7-1d00-0000-085c-4738a4100000 pid=4260 clone guuid=e80d3294-1c00-0000-085c-47384d0f0000 pid=3917->0eae001c-4ad4-599c-ab6a-77d3fac12203 send: 132B guuid=7ef8eae7-1d00-0000-085c-4738a5100000 pid=4261 /usr/bin/pgrep guuid=548cdae7-1d00-0000-085c-4738a4100000 pid=4260->guuid=7ef8eae7-1d00-0000-085c-4738a5100000 pid=4261 execve
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c5078d5aa13b0716014bc8c705e0c461251154e2ec4da60b57e369ed1fca2f29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5078d5aa13b0716014bc8c705e0c461251154e2ec4da60b57e369ed1fca2f29/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yudy2wvbhmdrmaklzddqlygemesrcvhc5rg2mc2x4nu62h6kf4uq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260811-n4rcjsdp4y/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c5078d5aa13b0716014bc8c705e0c461251154e2ec4da60b57e369ed1fca2f29

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Ladvix

sh c5078d5aa13b0716014bc8c705e0c461251154e2ec4da60b57e369ed1fca2f29

(this sample)

Ladvix

elf b5aef7ade103fd04b5b7e91bfcbba029565488b39d931d979a8c685595bc7009

  
URLhaus
https://urlhaus.abuse.ch/url/3901924/
  
Delivery method
Distributed via web download
  
Dropping
MD5 a3d2db00af34cef563efc18ded1249e6
  
Dropping
SHA256 b5aef7ade103fd04b5b7e91bfcbba029565488b39d931d979a8c685595bc7009
  
URLhaus
https://urlhaus.abuse.ch/url/3902236/

Comments